Privacy policy

Last updated: 3 September 2026

This Privacy Policy explains how Krystev International LTD., trading as CEO Board ("CEO Board", "we", "us" or "our"), collects, uses, discloses and protects personal information when you visit ceoboard.shop, purchase our digital products, contact us, subscribe to marketing, or submit a product review.

1. Who we are

The controller responsible for your personal information is:

Krystev International LTD.
UIC: 207331574
Registered office: Bulgaria, Sofia 1612, Krasno Selo District
Email: support.ceo.board@gmail.com
Website: https://ceoboard.shop

2. Information we collect

Depending on how you interact with our store, we may collect:

  • Contact and account information, such as your name, email address, billing address, country, and account login details if you create an account.

  • Order and transaction information, such as the products purchased, order value, currency, payment status, refunds and download fulfilment status.

  • Payment information. Payments are processed by the payment provider you select at checkout. We generally do not receive or store your complete card number or security code.

  • Device and usage information, such as IP address, browser and device type, operating system, referral page, pages viewed, interactions, approximate location and cookie or advertising identifiers.

  • Marketing information, such as subscription preferences, email engagement and interactions with our advertisements.

  • Review content, such as your rating, review text, name or initials and any photo you voluntarily upload.

  • Communications, including messages sent by email or through our Instagram and Facebook accounts.

Please do not include sensitive personal information or information about another person in reviews, uploaded photos or messages.

3. How we collect information

We collect information:

  • directly from you when you place an order, create an account, contact us, subscribe or leave a review;

  • automatically through cookies, pixels and similar technologies;

  • from service providers that help operate our store, process payments, deliver downloads, send communications, collect reviews, prevent fraud and measure advertising performance; and

  • from advertising and social-media platforms when you interact with our ads or profiles, subject to your settings and applicable law.

4. Why we use your information and our legal bases

We use personal information only when we have a lawful basis to do so.

Purpose Typical lawful basis
Process payments, fulfil orders, provide download access, manage accounts and provide customer support Performance of a contract or steps requested before entering a contract
Send essential order, account, security and service messages Performance of a contract and our legitimate interests in operating the store
Maintain financial, tax and transaction records and respond to lawful requests Compliance with legal obligations
Protect the store, prevent fraud, troubleshoot and improve performance Our legitimate interests in security and effective business operations
Send newsletters, promotions and personalised marketing Your consent where required; otherwise another lawful basis permitted by applicable law
Measure advertising and create or reach advertising audiences through Google, Meta and TikTok Your consent where required; otherwise our legitimate interests where permitted by law
Request, verify, moderate and display customer reviews Performance of a contract, our legitimate interests in collecting genuine feedback, and your consent for optional public content where required

Where we rely on legitimate interests, we consider the impact on your rights and use the information only where those interests are not overridden by your rights and freedoms.

5. Shopify and digital delivery

Our store is hosted by Shopify. Shopify processes information needed to operate the storefront, checkout, orders, customer accounts, security and related services. We may also use a Shopify-compatible digital-delivery application to make purchased files available after checkout. That provider receives only the information reasonably necessary to fulfil and support your digital order.

6. Payments

Payment options made available at checkout may include Shopify Payments, PayPal, Shop Pay, Apple Pay and Google Pay. The selected payment provider processes your payment information under its own privacy terms and may carry out fraud, security and compliance checks. We receive confirmation and limited transaction details necessary to complete and record your order.

7. Email and customer communications

We use Klaviyo to manage customer communications, including newsletters, marketing campaigns, abandoned-cart or abandoned-checkout reminders, post-purchase messages and other relevant store communications.

You can unsubscribe from marketing emails at any time by using the unsubscribe link in the message or by contacting us. Unsubscribing from marketing does not stop essential messages about an order, download, account, security issue or customer-service request.

If you contact us through Instagram or Facebook, Meta also processes that communication under its own privacy terms. For requests involving an order or privacy right, we may ask you to continue by email so that we can verify and handle the request securely.

8. Reviews and user-submitted content

We use Judge.me to request, collect, verify, moderate and display product reviews. A review may display the name or initials you provide, your rating, review text, verified-purchase status and any photo you choose to upload.

Review invitations may be sent after a purchase. You may opt out of review-request emails using the link provided or by contacting us. Reviews are voluntary. You may ask us to correct or remove personal information included in a review, subject to applicable law and legitimate recordkeeping needs.

By submitting a review or photo, you confirm that it is truthful, relates to your experience, does not violate another person's rights and that you have permission to submit the content. We may display submitted content on our store. We will not use a customer's photo in paid advertising outside the review display without separate permission.

9. Cookies, advertising and pixels

We and our providers use necessary cookies to operate checkout, security, accounts and core store functions. Subject to your consent choices and applicable law, we may also use advertising and measurement technologies connected to:

  • Google Ads for conversion measurement and advertising;

  • Meta, including the Meta Pixel and related business tools, for Facebook and Instagram advertising;

  • TikTok, including the TikTok Pixel and related business tools, for advertising and conversion measurement;

  • Klaviyo for email, customer engagement and marketing measurement; and

  • Shopify and installed applications for store operation, performance and customer privacy controls.

We do not currently use Google Analytics 4.

Where consent is required, non-essential advertising or measurement technologies should not activate until you make a choice through our cookie banner. You can change or withdraw your consent through the store's cookie-preference control and can also adjust browser or device settings. Withdrawing consent does not affect processing that occurred lawfully before withdrawal.

Some advertising laws use terms such as “sale”, “sharing” or “targeted advertising” for certain transfers of identifiers to advertising partners, even where no money is exchanged for personal information. We do not sell personal information for money. Where applicable, you may opt out of sale, sharing or targeted advertising through the privacy choices provided on our website.

10. When we disclose information

We may disclose personal information to:

  • Shopify and applications used to operate and fulfil the store;

  • payment and wallet providers used at checkout;

  • Klaviyo for email and customer communications;

  • Judge.me for review invitations and review functionality;

  • Google, Meta and TikTok for advertising and measurement, subject to consent and applicable law;

  • providers of hosting, security, fraud prevention, customer support, professional advice and technical services;

  • authorities, courts or other parties where required by law or necessary to protect legal rights; and

  • a successor or buyer in connection with a genuine business transaction, subject to appropriate safeguards.

We require service providers to process information for authorised purposes and according to applicable data-protection requirements.

11. International transfers

Some providers may process personal information outside Bulgaria, the European Economic Area or the United Kingdom, including in the United States. Where required, transfers are protected through an adequacy decision, approved standard contractual clauses or another lawful transfer mechanism, together with appropriate safeguards.

12. How long we keep information

We retain information only for as long as reasonably necessary for the purposes described above, including legal, tax, accounting, security and dispute-resolution obligations. Typical periods are:

  • order, payment and accounting records: for the period required by applicable tax and accounting law;

  • customer-account information: while the account is active and normally for up to two years after closure, unless a longer period is required;

  • customer-support communications: normally for up to two years after the matter is closed;

  • marketing records: until you withdraw consent or unsubscribe, and then limited suppression information so we can respect your choice;

  • reviews and submitted content: while the review is displayed or until removal is justified or requested, subject to legal and integrity requirements; and

  • cookie and advertising data: according to the duration shown in our cookie controls or the relevant provider settings.

We may retain information longer where necessary to establish, exercise or defend legal claims, prevent fraud, comply with law or resolve a dispute.

13. Security

We use reasonable technical and organisational measures intended to protect personal information. However, no internet transmission or storage method is completely secure. You are responsible for protecting your account credentials and should contact us if you believe your account or personal information has been compromised.

14. Your privacy rights

Depending on your location, you may have the right to:

  • receive information about how your personal information is used;

  • request access to or a copy of your personal information;

  • correct inaccurate or incomplete information;

  • request deletion of information in certain circumstances;

  • restrict or object to certain processing;

  • receive certain information in a portable format;

  • withdraw consent at any time where processing relies on consent;

  • opt out of certain targeted advertising, sale or sharing where applicable; and

  • lodge a complaint with a competent data-protection authority.

To exercise a right, email support.ceo.board@gmail.com. We may need to verify your identity and request before acting. We will respond within the period required by applicable law. You will not be discriminated against for exercising an applicable privacy right.

For EEA matters, you may complain to the Bulgarian Commission for Personal Data Protection or the supervisory authority where you live or work. For UK matters, you may contact the UK Information Commissioner's Office.

15. Children

Our products may be useful to a broad audience, but the store is not designed to knowingly collect personal information directly from children who cannot legally consent under applicable law. If you are under the age at which you can provide valid consent in your country, please use the store only with the involvement of a parent or legal guardian. If you believe a child has provided personal information improperly, contact us so we can review and delete it where appropriate.

16. Automated checks

We do not use your personal information to make solely automated decisions that produce legal or similarly significant effects. Payment, security and fraud-prevention providers may use automated systems to assess transactions under their own policies and applicable law.

17. Third-party links

Our store or communications may link to websites or services that we do not control. Their privacy practices are governed by their own policies, and we encourage you to review them.

18. Changes to this policy

We may update this Privacy Policy when our services, providers or legal obligations change. We will publish the updated version here and change the “Last updated” date. Where required, we will provide additional notice or request renewed consent.

19. Contact us

For privacy questions, requests or complaints, contact:

Krystev International LTD.
UIC: 207331574
Registered office: Bulgaria, Sofia 1612, Krasno Selo District
Email: support.ceo.board@gmail.com